It can require building a new string. But what is argued is that it wont require building several new strings incrementally for each concatenation.
E.g. no:
A + B + C + D -> AB + C + D -> ABC + D -> ABCD
And for immutable strings, it might not even require to build a new string at all, even if the string is in memory: it can just use a string data structure pointing to the various parts.
(
If the username came from the database, it's going to be stored in memory before this function is called, and so concatenating must require building a new string.